From: Jeff King <peff@peff.net>
Date: Thu, 22 May 2025 06:03:37 GMT
Subject: Re: [PATCH 10/11] bundle-uri: avoid using undefined output of `sscanf()`
Message-ID: <20250522060337.GA1137854@coredump.intra.peff.net>
In-Reply-To: <32de776c-9f15-4030-9f78-76384dd6dbb1@gmail.com>

On Mon, May 19, 2025 at 10:03:47AM +0100, Phillip Wood wrote:

> > So yeah, we probably do need something new. IMHO we should probably have
> > repo_config_get_u64() or similar (with the appropriate underlying
> > helpers as well) as use it here. But I am happy with any solution.
> I think repo_config_get_ulong() and friends all accept a multiplier suffix.
> That makes sense for things like packSizeLimit but here we're expecting a
> bare integer. It probably doesn't really matter but as one of the code paths
> parses a file that comes from the bundle server we might want to be as
> strict as we can be.

Yeah, I agree it's a little funny to allow suffixes where we wouldn't
expect them. But I do think there may be value in just consistently
accepting them for any numeric config value.

I dunno. I am OK with the more limited solution you proposed.

-Peff